Data Protection Notice

Information Notice under Personal Data Protection Law no. 6698

1. Data controller

Legal name: XSunucu İnternet Teknolojileri
Address: Cumhuriyet Mah. Alpt. Küme Evleri Toki D Blok No: 1DM Beşikdüzü Trabzon Türkiye
Phone: +90 850 532 1732
E-mail: [email protected]
Tax office / number: Beşikdüzü VD / 6760228034
Service provider certificate no: YS-3213
Website: https://antikcag.com

XSunucu İnternet Teknolojileri (the "Data Controller") acts as data controller under Turkish Personal Data Protection Law no. 6698 ("KVKK").

2. Categories of personal data processed

Identity: username, in-game display name.
Contact: e-mail address and any contact details you share in support tickets.
Transaction security: IP address, session records, login/logout times, device and browser information, app installation identifier, notification token.
Customer transactions: purchase records, order numbers, payment status, bank transfer sender name and receipt, refund records.
Marketing: advertising identifier and your consent preference (only where you gave explicit consent).
Other: in-game progress, message and report data.

3. Purposes of processing

Creating a membership record and managing the account.
Providing the game service and executing in-game transactions.
Running purchase, invoicing, refund and accounting processes.
Detecting cheating, bots, multi-accounting and fraud, and ensuring information security.
Handling support requests and resolving complaints.
Meeting legal obligations, including providing information to competent authorities.

4. Legal bases (KVKK art. 5)

Necessary for the conclusion or performance of a contract (art. 5/2-c): account creation, provision of the game service, purchases.
Compliance with a legal obligation (art. 5/2-ç): invoice and record retention duties.
Legitimate interests of the controller (art. 5/2-f): cheating and fraud detection, system security, service improvement.
Explicit consent (art. 5/1): personalised advertising and marketing.

5. Method of collection

Data is collected by automated and partly automated means through website registration and login forms, in-game interactions, the Android application, the support system, notifications returned by payment providers, and server logs.

6. Transfers

Under KVKK art. 8 and 9, your data may be transferred to the hosting provider, payment institutions (Stripe, Google Play Billing), advertising and notification providers (Google AdMob, Firebase Cloud Messaging), and to competent public authorities where legally required. Transfers abroad occur as required by those providers' service infrastructure and in accordance with the conditions set out in KVKK.

7. Retention periods

Account data: while the account is active, and at most 30 days after a deletion request.
Payment and invoice records: 10 years (Tax Procedure Law and Turkish Commercial Code).
Transaction security records: 12 months.
Support correspondence: 3 years after the ticket is closed.
Hall of Fame archive: indefinitely, with username and ranking information.

8. Rights of the data subject (KVKK art. 11)

To learn whether your personal data is processed.
To request information if it has been processed.
To learn the purpose of processing and whether the data is used in line with that purpose.
To know the third parties to whom the data is transferred, in Türkiye or abroad.
To request rectification if the data is incomplete or inaccurate.
To request erasure or destruction under the conditions in KVKK art. 7.
To request that rectification, erasure and destruction be notified to third parties to whom the data was transferred.
To object to a result reached against you through analysis solely by automated systems.
To claim compensation for damage suffered due to unlawful processing.

9. How to apply

To exercise your rights, in accordance with the Communiqué on Application Procedures to the Data Controller:

E-mail: [email protected] (from the address registered to your account)
Written application: Cumhuriyet Mah. Alpt. Küme Evleri Toki D Blok No: 1DM Beşikdüzü Trabzon Türkiye

Your application is concluded within 30 days at the latest. If your application is refused or not answered in time, you may file a complaint with the Personal Data Protection Board.

Last updated: this notice is effective as of its publication date.